📚 Step 7 of Your Riot activation journey.
⬅️ Previous step: 6️⃣ Check your billing information
💡 Prerequisite: having completed the setup of your workspace (steps 1 to 6).
Simulation sends your employees fake phishing emails, smishing messages and more, to train them to recognise real attacks. The most effective approach is a recurring campaign: you create it once, and it repeats automatically, for example every month, across your whole audience. Your employees stay trained, with no action on your part.
💡 Prerequisites:
Administrator access to Riot, and being signed in to hub.tryriot.com;
a plan that includes the Simulation module;
validated domains (step 2): without them, simulations cannot be sent.
❶ Create your campaign
👉 Step 1: Open Simulation and create a campaign
In the left-hand column of your screen, under Apps, click Simulation. At the top right of the page, click Create a campaign.
👉 Step 2: Choose the audience
Select the employees who will receive the campaign. With All employees, the campaign is sent to all active employees in Riot. To activate or deactivate an employee, go to the Team menu in the left-hand column.
👍 Good to know: an error message appears if some employees in the audience have an address on a domain that has not been validated. Validate that domain in Settings > Domains (step 2), then come back to your campaign.
👉 Step 3: Choose the attack templates
Select the fake emails to use. Riot sends each employee a template picked at random from those you have chosen: so choose templates that make sense for your whole audience. To help you: Prepare my phishing templates.
👉 Step 4: Make the campaign recurring
Choose a sending frequency, then click Repeat the campaign. The campaign will start again automatically at the end of each period.
💡 Our recommendation: at the very least, a monthly recurring campaign. It repeats itself every month across the whole audience. For a one-off campaign, click End the campaign instead.
👉 Step 5: Choose the options
Deliver a short training (recommended): an employee who falls for it learns that it was an exercise and receives a few tips so they are not caught out again.
Send a follow-up report: an email summary of the campaign's key figures (number of attacks sent, vulnerability rate…), sent to the whole audience or only to employees who were caught out.
❷ Allow attacks to be sent
On a new Riot account, sending attacks is turned off by default. It is a safeguard: you can create and schedule your campaigns, but no email is actually sent until you have given the go-ahead.
👉 Step 1: Open the Simulation settings
From the Simulation menu, open its settings by clicking the small ⚙️
👉 Step 2: Turn on sending
Turn on the Enable attack sending switch.
To find out more about this setting (called "rollout"): Activate Simulation Rollout.
⚠️ Important: if you turn this setting off later, your ongoing campaigns are paused.
❸ Launch the campaign
👉 Step 1: Click Launch
Go back to your campaign and click Launch, at the top right of your screen.
👉 Step 2: Choose when it starts
Launch the campaign: it starts immediately;
Schedule for later: choose the start date.
👍 Good to know: as long as a scheduled campaign hasn't started, you can edit or cancel it from the campaign page.
🛠️ A problem?
An error message about a domain that has not been validated: see step 2.
Your employees don't receive the simulations, or the page is shown as dangerous when they click: check the settings of your email system and security tools described in step 2. On Microsoft Edge, also see Allowlist Riot simulation domains in Microsoft Edge (Defender SmartScreen).
Still stuck? Contact our team via the chat in the platform.
Key takeaways
A campaign is created from the Simulation menu, Create a campaign button.
Choose Repeat the campaign with at least a monthly frequency: it then runs on its own.
Turn on Enable attack sending in the Simulation settings, otherwise nothing is sent.
Launch straight away or schedule a start date.
📚 Ready for the next step?